CVE-2010-1328: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 tipo or 2 destino parameter to loginregistrese.php3 in the Services section, 3 the rubro parameter to precios.php3 in the Products section, 4...

CVE-2010-1327: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the marca parameter to precios.php3 or 2 the where parameter in a deliverycourier action to control/abmlist.php3...